newenrollmentplans.com Open in urlscan Pro
172.67.194.109 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://premiersubsidynow.com/
Effective URL:
https://newenrollmentplans.com/
Submission Tags: phishingrod
Submission: On September 21 via api (September 21st 2024, 8:46:43 am UTC) from DE — Scanned from NL

Summary HTTP 32 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 3 countries across 9 domains to perform 32 HTTP transactions. The main IP is 172.67.194.109, located in United States and belongs to CLOUDFLARENET, US. The main domain is newenrollmentplans.com.
TLS certificate: Issued by WE1 on September 21st 2024. Valid for: 3 months.

This is the only time newenrollmentplans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
8	172.67.194.109 172.67.194.109	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
3	142.250.186.163 142.250.186.163	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::6816:27b6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	34.196.71.161 34.196.71.161	14618 (AMAZON-AES) (AMAZON-AES)
1	13.32.23.225 13.32.23.225	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:249... 2600:9000:2490:8c00:4:1957:6500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	54.198.216.137 54.198.216.137	14618 (AMAZON-AES) (AMAZON-AES)
32	12

8 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

premiersubsidynow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.67.194.109 (United States)

ASN13335 (CLOUDFLARENET, US)

newenrollmentplans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:27b6 (United States)

ASN13335 (CLOUDFLARENET, US)

create.lidstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.196.71.161 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-71-161.compute-1.amazonaws.com

create.leadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.23.225 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-23-225.fra56.r.cloudfront.net

d2m2wsoho8qq12.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2490:8c00:4:1957:6500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-js.ringba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.198.216.137 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-198-216-137.compute-1.amazonaws.com

display.ringba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	newenrollmentplans.com newenrollmentplans.com	206 KB
8	premiersubsidynow.com premiersubsidynow.com	59 KB
3	leadid.com create.leadid.com — Cisco Umbrella Rank: 14091	2 KB
3	gstatic.com fonts.gstatic.com	83 KB
3	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 405 fonts.googleapis.com — Cisco Umbrella Rank: 32	34 KB
2	ringba.com b-js.ringba.com — Cisco Umbrella Rank: 124439 display.ringba.com — Cisco Umbrella Rank: 117250	14 KB
1	cloudfront.net d2m2wsoho8qq12.cloudfront.net
1	lidstatic.com create.lidstatic.com — Cisco Umbrella Rank: 22523 Failed	39 KB
1	facebook.net connect.facebook.net — Cisco Umbrella Rank: 187	58 KB
32	9

	Domain	Requested by
8	newenrollmentplans.com	premiersubsidynow.com newenrollmentplans.com
8	premiersubsidynow.com	premiersubsidynow.com
3	create.leadid.com	create.lidstatic.com
3	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	newenrollmentplans.com
1	display.ringba.com	b-js.ringba.com
1	b-js.ringba.com	premiersubsidynow.com
1	d2m2wsoho8qq12.cloudfront.net	create.lidstatic.com
1	create.lidstatic.com	premiersubsidynow.com
1	connect.facebook.net	premiersubsidynow.com connect.facebook.net
1	ajax.googleapis.com	premiersubsidynow.com
32	11

This site contains no links.

Subject Issuer	Validity	Valid
premiersubsidynow.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
newenrollmentplans.com WE1	`2024-09-21` - `2024-12-20`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-30` - `2024-09-28`	3 months	crt.sh
*.gstatic.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
lidstatic.com E6	`2024-09-20` - `2024-12-19`	3 months	crt.sh
create.leadid.com Amazon RSA 2048 M03	`2024-07-20` - `2025-08-18`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
*.ringba.com Amazon RSA 2048 M03	`2023-11-27` - `2024-12-23`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://newenrollmentplans.com/
Frame ID: 2EC3F36F685F1C0DEEA66FB1917372A4
Requests: 31 HTTP requests in this frame

Frame: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=B16FC7AC-4BD9-F7CA-A39F-E37A2BC92B7A&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.0&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Frame ID: F4D3DD761A8109581F6ABA432E239264
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MyObamacareRates

Page URL History Show full URLs

https://premiersubsidynow.com/ Page URL
https://newenrollmentplans.com/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

32
Requests

94 %
HTTPS

36 %
IPv6

9
Domains

11
Subdomains

12
IPs

3
Countries

495 kB
Transfer

1082 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://premiersubsidynow.com/ Page URL
https://newenrollmentplans.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
premiersubsidynow.com/ 33 KB
7 KB 402ms
301ms Document
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://premiersubsidynow.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 58e449e092cef646cf8a9dc3e467959c978ddb06ce57a50ed18973cf0cd82b29

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
cache-control: max-age=2678400
cf-cache-status: REVALIDATED
cf-ray: 8c68c9275ba56673-AMS
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 21 Sep 2024 08:46:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fU7xezwWG%2FyI7J%2BMV4DThjheLVjrH%2FpTajjev1HyrOo14RadCuRckkwWYnvaQePjdGeUTCTxzQa2hxtbYloSRWPRZBNGYLHSnY2i%2BhI5Kmi%2BzNNUbpoZj%2FnlwUP7hmzq1WL%2B8fmO3oo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-powered-by: Express

GET
H3 200 speculation
premiersubsidynow.com/cdn-cgi/ 128 B
556 B 23ms
23ms Other
application/speculationrules+json 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://premiersubsidynow.com/cdn-cgi/speculation
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://premiersubsidynow.com
Referer: https://premiersubsidynow.com/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h%2BHFdSQdTpu8I2Ayu7Y3o9%2Fvg%2FAgyR9PcF0YT6Cw0ZGtsI8qBrCkK76o96rdeXJ%2Fw5lVZ3bmSGCqSP7aMK%2BXfowzSqwKVo%2Bv9KtEKmz5E3diUdwZidGQNRmDw4OK%2FWppx7I2PgPTy7k%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9294da96673-AMS
access-control-allow-origin: https://premiersubsidynow.com
content-length: 128
date: Sat, 21 Sep 2024 08:46:37 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H3 200 style.css
premiersubsidynow.com/css/ 15 KB
5 KB 405ms
404ms Stylesheet
text/css 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://premiersubsidynow.com/css/style.css
Requested by: Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 1f61485459388667aa67b730453d0609c34816d64c5bbed1dafe058b645c4ecd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://premiersubsidynow.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: MISS
etag: W/"3d0e-Sje+ZDMHKG5AEiXzJa/0Iu3cT9A"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NTojtAQzvAF9Gq27LP88JtbEqv%2F5MmCZKk2C7yFzPQPcODmSdzVm6R18EW7CFu9Roz77Q41Jgjz7UOoz0aEtSBXlVjwOqLjsBH13X%2BfjwrOn9mq6yIfhGxski2zau08hhblML0KlBus%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9294dab6673-AMS
access-control-allow-origin: *
date: Sat, 21 Sep 2024 08:46:37 GMT
content-type: text/css; charset=utf-8
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

GET
H3 200 staff.jpg
premiersubsidynow.com/images/ 22 KB
22 KB 394ms
394ms Image
image/jpeg 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiersubsidynow.com/images/staff.jpg
Requested by: Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9109818aa3e59aa5fd052a2e55ec5c824e1af22f07aacee86c9561b2f33f935d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://premiersubsidynow.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: MISS
etag: W/"5641-rCTHx6YvHccfxDdjK1qerIWRgmo"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9YkF%2BtZo9mg%2BVahp6D8AfjgoG%2FW0zpGHCF%2FXxXpNZfhPu8C0EGQOPg7FQfD9FZfmtO0idpnzgGKBre18dD%2Bm0YNh55ZeDstXoiu8F%2BEctJYq4F9xEWVHuBTtfAsh%2BM%2BTVZrBfHqWmx0%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9294dac6673-AMS
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22081
date: Sat, 21 Sep 2024 08:46:37 GMT
content-type: image/jpeg
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

GET
H3 200 profile.png
premiersubsidynow.com/images/ 19 KB
19 KB 372ms
372ms Image
image/png 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://premiersubsidynow.com/images/profile.png
Requested by: Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 028bf096de9208f1199b5f3c61b17f34cfe6284fd58018a1c9765d5f82d0fc36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://premiersubsidynow.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: MISS
etag: W/"4b5d-ubf+cR7rvAk2B68XiXycHMgv7ik"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6y1VqRR%2FUSZK%2FGLUPGkIsfVSeLuUnYsWuGIs6oHZrLf8DpXscyR0mv%2FtSecF%2Fmwk0XmtlUSMivURaeG7W6WnaElisb9IsomfDn0V4pjIAa0ir2XzncRg2FWep%2B2mRP7dwEMRbXm1PDA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9294dad6673-AMS
accept-ranges: bytes
access-control-allow-origin: *
content-length: 19293
date: Sat, 21 Sep 2024 08:46:37 GMT
content-type: image/png
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

GET
H3 200 rocket-loader.min.js Show response
premiersubsidynow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 19ms
19ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://premiersubsidynow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://premiersubsidynow.com/

Response headers

x-frame-options: DENY
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"66e7fb1c-302c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oTvL8txhXogstksc2Ykmz5nHSxcxLsZYmagATc5xtmnKk2W6d%2FqaFWa%2FHNhDpMEODq4YJoSaGhl1e9u6F8lQtc6KnazylflLdFcMYUPwST%2FQ0XYCMM3YUdcW2GBfAxkGci4EvsdPedw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8c68c9295dc06673-AMS
expires: Mon, 23 Sep 2024 08:46:37 GMT
date: Sat, 21 Sep 2024 08:46:37 GMT
content-type: application/javascript
last-modified: Mon, 16 Sep 2024 09:32:12 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 160ms
50ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://premiersubsidynow.com/

Response headers

content-encoding: gzip
age: 386750
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Tue, 16 Sep 2025 21:20:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Sep 2024 21:20:47 GMT
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31017
x-xss-protection: 0
server: sffe

GET
H3 200 absf_v1.0_references.js Show response
premiersubsidynow.com/js/ 2 KB
1 KB 310ms
309ms Script
application/javascript 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://premiersubsidynow.com/js/absf_v1.0_references.js
Requested by: Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 1e0f4c60b24a216e08255216e880fbd33a83fa176a1cac2e9777a8e8868b5d4d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://premiersubsidynow.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: MISS
etag: W/"771-rogS1uaP/DJEOFeHW3rK0oyWzPk"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JLUi4a6Js4%2BvGThnjg6MpOPjOtxhFCv1zGsZY8zziIOz8%2BBWkjXO8FqTartEFEhU2VEwyQesCilFsIn0bEo%2BAasG%2BDfmHoFFhWjoILGRYMTeKqh0Zi743Kp0fRD8CjgCDUcmdk3eySQ%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c92bd83d6673-AMS
access-control-allow-origin: *
date: Sat, 21 Sep 2024 08:46:37 GMT
content-type: application/javascript; charset=utf-8
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

GET
H3 404 favicon.ico
premiersubsidynow.com/ 9 B
480 B 251ms
251ms Other
text/plain 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://premiersubsidynow.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://premiersubsidynow.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: MISS
etag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fz8RwE0kRDIrIixvyGPj6KzkhzGQRwe3%2F%2FUwCWkIbFsOa4qQkQsCAJLuHmD5QKDntlIBTIY4aHhk38DNegbb1vSjNwvGIgtZO89RyXsr1l%2FuNVfz7GeBnp%2Bop%2BsM5cNb%2FrFU%2Fd7ImTg%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c92bd83f6673-AMS
access-control-allow-origin: *
content-length: 9
date: Sat, 21 Sep 2024 08:46:37 GMT
content-type: text/plain; charset=utf-8
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

GET
H3 200 Primary Request / Show response
newenrollmentplans.com/ 23 KB
6 KB 342ms
300ms Document
text/html 172.67.194.109
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://newenrollmentplans.com/
Requested by: Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/js/absf_v1.0_references.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.194.109 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: bbcaf72a104039211250b86b7c09d3df175ea10173e70e4740edbc822ae5c89c

Request headers

Referer: https://premiersubsidynow.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: max-age=2678400
cf-cache-status: REVALIDATED
cf-ray: 8c68c92e19a4d592-AMS
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 21 Sep 2024 08:46:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SQPXrsqHPRcCnl6tjgJ3lFq6LIEszbVz90lnyJznKBJ7vz4bsFPpD68quMwvpyZqetGz%2BNevaVpQKAOrjIQXnkQf298sapQFC17kmcFcNE0On2unITdXBVS10SRVnBVlTe%2B79ZUUeiS3"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-powered-by: Express

GET
H3 200 fbevents.js
connect.facebook.net/en_US/ 225 KB
58 KB 48ms
23ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://premiersubsidynow.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Sat, 21 Sep 2024 08:46:37 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=21, rtx=0, c=23, mss=1232, tbw=4419, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: FOoMwW8NhNeT0nycmOS3uJ+gp6w4dgfcvE7q1RSRF/gZ4cyakRggSOXDOWDiIf+MAZ9gXmMrtqsc+0J/z5iN4w==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 58953
x-xss-protection: 0
origin-agent-cluster: ?0

GET a57816b4-6c59-f397-7853-7e14e45d3e1b.js
create.lidstatic.com/campaign/ 0
0

GET 155540777344890
connect.facebook.net/signals/config/ 0
0

GET
H3 200 speculation
newenrollmentplans.com/cdn-cgi/ 128 B
549 B 21ms
21ms Other
application/speculationrules+json 172.67.194.109
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://newenrollmentplans.com/cdn-cgi/speculation
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.194.109 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://newenrollmentplans.com
Referer: https://newenrollmentplans.com/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jUAobBnvOagANsMMqjUCvmXaQcqN%2Bym7h0q290elvlu6HaUezwnN3XC7yKP4eL0KXhIXKYEv%2FoFgXbdA72XdA6MQLm%2FThGGh8Hw19sTmj6HHdmZKXg92jye2LFlQMFK6wVNCsRzhh9UG"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9300e33d592-AMS
access-control-allow-origin: https://newenrollmentplans.com
content-length: 128
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H3 200 bootstrap.min.css
newenrollmentplans.com/css/ 158 KB
25 KB 369ms
367ms Stylesheet
text/css 172.67.194.109
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://newenrollmentplans.com/css/bootstrap.min.css
Requested by: Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.194.109 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f886516f3d41e9e7bd994c7f7a39a89cafae9483f90396cb0ddeafe8d1ea5e72

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://newenrollmentplans.com
Referer: https://newenrollmentplans.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: REVALIDATED
etag: W/"279d8-G+N7YjBsjAxndbtMk8XkxOE9l3U"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0I%2BTBzPyYGQlr3RLJ6ki5OGdk6mjNsZtNlnTLZVncRRKHCAkV3DjIcnRtYSFhOO6w23Ql6KfQNq3Dx2OmKmt7%2Bn5pxBYobwZqzIVQ3K0rkcCIPe9g3%2FAy3EnsFx1dTPNslVPImF4sqRE"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9300e38d592-AMS
access-control-allow-origin: *
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: text/css; charset=utf-8
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

GET
H2 200 css
fonts.googleapis.com/ 9 KB
890 B 93ms
34ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700|Roboto+Slab:400,700&display=swap

Requested by

Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c613488d49d9d604961ddea2972072c9aadfee63019fb3054d42e1ea67494a34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://newenrollmentplans.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 21 Sep 2024 08:46:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 21 Sep 2024 08:46:38 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 23 KB
2 KB 89ms
30ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap

Requested by

Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2edca8c7b268ea2c28f1c0163a70761b07268cab6b11386456cfdcd4759cdf1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://newenrollmentplans.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 21 Sep 2024 08:46:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 21 Sep 2024 08:46:38 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 logo.png
newenrollmentplans.com/images/ 114 KB
114 KB 387ms
386ms Image
image/png 172.67.194.109
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://newenrollmentplans.com/images/logo.png
Requested by: Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.194.109 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d1854f2659dc32e24936df4a715d520ba3b2d3da5b03a3fe84d5904446bbb20a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://newenrollmentplans.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: REVALIDATED
etag: W/"1c760-KNQWKKlfM4e9HIFYB5aik573NbA"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6omatwKUG939KNyQsf66tThR7XgiNCji6lySGqPM636zBLa5c5sjyV6EQSK7uak%2BraOnxRDGmqRolZapS%2F%2Bo6G77TaoMfJ1P%2F3SMle1c0P%2FLL3SmepGKY0Qb0kEKICqKJyxfwLa3PC2w"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9300e39d592-AMS
accept-ranges: bytes
access-control-allow-origin: *
content-length: 116576
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: image/png
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

GET
H3 200 image.jpg
newenrollmentplans.com/images/ 31 KB
31 KB 311ms
310ms Image
image/jpeg 172.67.194.109
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://newenrollmentplans.com/images/image.jpg
Requested by: Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.194.109 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f70a1c4355672de33b4f6af28f01121e969e9ac38365905c7ba6b4701a054792

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://newenrollmentplans.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: REVALIDATED
etag: W/"7a46-zYQ/YRN1YIvI9yrQhgtF7UwkqkI"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AniFYM29bD6PklRgGl2kNytS%2Bl%2BY%2FreDwjv8Wk9TrBSA%2FEMP8NXxUK%2BzfOHpA959hM4v2%2Fr8%2B%2BYfz0nWMPvHzjkfH%2FctouEt5Ewq5oEm2KgOrUSBUeyAdYFyaTe0nHV6JdmFUiin0VDo"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9300e3bd592-AMS
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31302
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: image/jpeg
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

GET
H3 200 rocket-loader.min.js Show response
newenrollmentplans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 20ms
20ms Script
application/javascript 172.67.194.109
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newenrollmentplans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.194.109 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://newenrollmentplans.com/

Response headers

x-frame-options: DENY
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"66e7fb1c-302c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7oQk7VoeKeai86XDLWwKKVD3L3rGkek7kg6GPKHIOHkyCoqy7B6vyKr0BJT0GkHB2Lg%2FoaaR6EVjxOwpM%2BOw1Sh1ZxHHIth112kL6afp%2Fy4YYaPH00OXHmtYMbQYvJDWKkouPhq%2BzHpk"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8c68c9304ebfd592-AMS
expires: Mon, 23 Sep 2024 08:46:38 GMT
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: application/javascript
last-modified: Mon, 16 Sep 2024 09:32:12 GMT
server: cloudflare
vary: Accept-Encoding

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 110ms
45ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://newenrollmentplans.com
Referer: https://fonts.googleapis.com/

Response headers

age: 37330
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 20 Sep 2025 22:24:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 20 Sep 2024 22:24:28 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 89ms
25ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700|Roboto+Slab:400,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://newenrollmentplans.com
Referer: https://fonts.googleapis.com/

Response headers

age: 334499
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 17 Sep 2025 11:51:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 17 Sep 2024 11:51:39 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 87ms
23ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700|Roboto+Slab:400,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://newenrollmentplans.com
Referer: https://fonts.googleapis.com/

Response headers

age: 334533
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 17 Sep 2025 11:51:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 17 Sep 2024 11:51:05 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

GET
H3 200 bootstrap.bundle.min.js Show response
newenrollmentplans.com/js/ 79 KB
24 KB 356ms
355ms Script
application/javascript 172.67.194.109
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://newenrollmentplans.com/js/bootstrap.bundle.min.js
Requested by: Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.194.109 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9520018fa5d81f4e4dc9d06afb576f90cbbaba209cfcc6cb60e1464647f7890b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://newenrollmentplans.com
Referer: https://newenrollmentplans.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: REVALIDATED
etag: W/"13a24-kNFQNu9I/LM2oTW66BK0VmnxkEQ"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w%2BBnLN3MDVczypICRH5KPvp%2BSLpwisOyGhHr%2Fh8zB8htJ2vn%2B5iJNpqQDwqdaUqIjsHkmdvure8R5HTy2k9xRiWiaFR%2Fe7Gd8UWR9BNZy6Ji1znlnca5WRcbokvUbNR%2FQufRL%2FZPvWfL"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9328c99d592-AMS
access-control-allow-origin: *
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: application/javascript; charset=utf-8
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

GET
H2 200 a57816b4-6c59-f397-7853-7e14e45d3e1b.js Show response
create.lidstatic.com/campaign/ 121 KB
39 KB 67ms
31ms Script
text/javascript 2606:4700:10::6816:27b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Requested by: Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:27b6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed0e6c2dafc13789782abc2ce063f93fe13d7593579892cc011ce3476b59518c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://newenrollmentplans.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"35d91dfa10afd33468128e615d1cb79a"
x-amz-version-id: YQ9BV3llj1DXtLkmz3pgw4yI1Z4XMpii
age: 0
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: text/javascript
last-modified: Mon, 15 Jul 2024 17:21:37 GMT
vary: Accept-Encoding
x-amz-id-2: 1kDz84YJjzPBPO5gfzMK/ATV10ccohqYRsJg95l+OhrqmYt01g86ZBXIRVtyWJYMpF9xneeew+o=
x-amz-replication-status: COMPLETED
cache-control: max-age=1800
x-amz-request-id: 74KVXH160SHGFW8K
cf-ray: 8c68c933aa8c0b40-AMS
access-control-allow-origin: *
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 404 favicon.ico
newenrollmentplans.com/ 9 B
475 B 247ms
247ms Other
text/plain 172.67.194.109
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://newenrollmentplans.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.194.109 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://newenrollmentplans.com/

Response headers

cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: MISS
etag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lQVQE%2Bo%2BtqwKOCWZEZ3%2Fqgfk5rDGvs3SpURVrG3yDtxxZOWm36RweTmGn5x5V3H97myCrgBIr8Sh4A17BEmNalJIPiqMhbfzgEXh%2BZf635Y0a%2FIbLHcYqPEk7nRv9XfrNu2vSbWCzQPE"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c68c9337f12d592-AMS
access-control-allow-origin: *
content-length: 9
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: text/plain; charset=utf-8
x-powered-by: Express
vary: Accept-Encoding
server: cloudflare

POST
H2 200 GenerateToken Show response
create.leadid.com/2.15.0/ 36 B
659 B 363ms
146ms XHR
text/plain 34.196.71.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.15.0/GenerateToken?msn=1&pid=27e3cfcf-8b01-44d5-952f-57d1691a0e30&_=873675067

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.196.71.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-196-71-161.compute-1.amazonaws.com

Software

nginx /

Resource Hash

c7c98e71bfcd2aa6867179314b7c4f10e39a49c37c1e038fa97528af88000940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://newenrollmentplans.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-max-age: 1728000
cache-control: no-cache, must-revalidate
content-encoding: gzip
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
date: Sat, 21 Sep 2024 08:46:39 GMT
content-type: text/plain;charset=UTF-8
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type

GET
H/1.1 200
OK iframe.html
d2m2wsoho8qq12.cloudfront.net/ Frame F4D3 0
0 82ms
24ms Document
text/html 13.32.23.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=B16FC7AC-4BD9-F7CA-A39F-E37A2BC92B7A&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.0&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.32.23.225 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-23-225.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://newenrollmentplans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: *
Access-Control-Allow-Origin: *
Age: 6196
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Sat, 21 Sep 2024 07:03:23 GMT
Etag: W/"668f4bcd-dbb"
Last-Modified: Thu, 11 Jul 2024 03:04:45 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
Via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: SVKd36NVAB4jFUYRjg7tFn1CW-pY6II6e8-PIyiI67KoXynmwyjwOw==
X-Amz-Cf-Pop: FRA56-C2
X-Cache: Hit from cloudfront

POST
H2 200 SaveDom Show response
create.leadid.com/2.15.0/ 0
623 B 105ms
104ms XHR
text/plain 34.196.71.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.15.0/SaveDom?msn=2&pid=27e3cfcf-8b01-44d5-952f-57d1691a0e30&token=B16FC7AC-4BD9-F7CA-A39F-E37A2BC92B7A&_=873675068

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.196.71.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-196-71-161.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://newenrollmentplans.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-max-age: 1728000
cache-control: no-cache, must-revalidate
content-encoding: gzip
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
date: Sat, 21 Sep 2024 08:46:39 GMT
content-type: text/plain;charset=UTF-8
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2 200 CA3efe1122f0fc479bb67e286818ec6966 Show response
b-js.ringba.com/ 13 KB
14 KB 307ms
213ms Script
text/html 2600:9000:2490:8c00:4:1957:6500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-js.ringba.com/CA3efe1122f0fc479bb67e286818ec6966
Requested by: Host: premiersubsidynow.com
URL: https://premiersubsidynow.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:8c00:4:1957:6500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 40b92a286487253950fe9ceb5d47f93fb845d3e8709c96d107674f8600595ce4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://newenrollmentplans.com/

Response headers

x-amz-cf-pop: FRA56-P6
access-control-max-age: 300
cache-control: public
x-aspnet-version: 4.0.30319
via: 1.1 6b85d8725dd6471c3db1f65d4096afc4.cloudfront.net (CloudFront)
expires: Sat, 21 Sep 2024 08:51:39 GMT
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 13534
x-amz-cf-id: SohfK9s_Tl-BvvQHwDxDHKNFFlsUAUamipmFsDwOa8eKv1vxqqHqOg==
date: Sat, 21 Sep 2024 08:46:38 GMT
content-type: text/html; charset=utf-8
x-powered-by: ASP.NET
server: Microsoft-IIS/10.0
x-runtime: 0.0000

POST
H2 200 Snap Show response
create.leadid.com/2.15.0/ 0
622 B 306ms
203ms XHR
text/plain 34.196.71.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.15.0/Snap?msn=3&pid=27e3cfcf-8b01-44d5-952f-57d1691a0e30&token=B16FC7AC-4BD9-F7CA-A39F-E37A2BC92B7A&_=873675069

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.196.71.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-196-71-161.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://newenrollmentplans.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-max-age: 1728000
cache-control: no-cache, must-revalidate
content-encoding: gzip
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
date: Sat, 21 Sep 2024 08:46:39 GMT
content-type: text/plain;charset=UTF-8
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type

POST
H/1.1 200
OK gnbulk Show response
display.ringba.com/v2/nis/ 408 B
801 B 423ms
104ms XHR
application/json 54.198.216.137
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://display.ringba.com/v2/nis/gnbulk
Requested by: Host: b-js.ringba.com
URL: https://b-js.ringba.com/CA3efe1122f0fc479bb67e286818ec6966
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.216.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-216-137.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 08b2dfaf91bcff843e4f21b930e8d467e539ff01d8246ee8151bd15605c34cdd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://newenrollmentplans.com/

Response headers

Access-Control-Max-Age: 300
Cache-Control: no-cache
X-AspNet-Version: 4.0.30319
Pragma: no-cache
Connection: keep-alive
Expires: -1
Access-Control-Allow-Origin: https://newenrollmentplans.com
Content-Length: 408
Date: Sat, 21 Sep 2024 08:46:39 GMT
Content-Type: application/json; charset=utf-8
X-Powered-By: ASP.NET
Server: Microsoft-IIS/10.0
X-Runtime: 0.0040

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Domain: connect.facebook.net
URL: https://connect.facebook.net/signals/config/155540777344890?v=2.9.167&r=stable&domain=premiersubsidynow.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
newenrollmentplans.com/	1969-12-31 23:59:59	Name: leadid_token-F252983F-4BD1-0DD8-CD81-F4700AF60B66-A57816B4-6C59-F397-7853-7E14E45D3E1B Value: B16FC7AC-4BD9-F7CA-A39F-E37A2BC92B7A
.trueleadid.com/	1969-12-31 23:59:59	Name: nlbi_3051494 Value: DsuETrWrGVtF3Q5bC30iGwAAAABw+Cm10tUbYUq/91q16tdu
.trueleadid.com/	1970-01-21 08:26:57	Name: visid_incap_3051494 Value: csvYgoRyR+Kn31C/oqK5we6H7mYAAAAAQUIPAAAAAAD06T6JtP1rY0FN5NyQMUuG
.trueleadid.com/	1969-12-31 23:59:59	Name: incap_ses_1687_3051494 Value: 4wVeJcC+HUVsFCe7om1pF++H7mYAAAAAxEvWpS5MkjdmLxZHT6TRqg==
.deviceid.trueleadid.com/	1970-01-21 09:17:48	Name: uuid Value: 9e151859a07e435ca3d2ca58809e3d48

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://premiersubsidynow.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://newenrollmentplans.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
b-js.ringba.com
connect.facebook.net
create.leadid.com
create.lidstatic.com
d2m2wsoho8qq12.cloudfront.net
display.ringba.com
fonts.googleapis.com
fonts.gstatic.com
newenrollmentplans.com
premiersubsidynow.com
connect.facebook.net
create.lidstatic.com
13.32.23.225
142.250.186.163
157.240.0.6
172.67.194.109
188.114.96.3
2600:9000:2490:8c00:4:1957:6500:93a1
2606:4700:10::6816:27b6
2a00:1450:4001:810::200a
2a00:1450:4001:82f::200a
34.196.71.161
54.198.216.137
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
028bf096de9208f1199b5f3c61b17f34cfe6284fd58018a1c9765d5f82d0fc36
08b2dfaf91bcff843e4f21b930e8d467e539ff01d8246ee8151bd15605c34cdd
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
1e0f4c60b24a216e08255216e880fbd33a83fa176a1cac2e9777a8e8868b5d4d
1f61485459388667aa67b730453d0609c34816d64c5bbed1dafe058b645c4ecd
2edca8c7b268ea2c28f1c0163a70761b07268cab6b11386456cfdcd4759cdf1d
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
40b92a286487253950fe9ceb5d47f93fb845d3e8709c96d107674f8600595ce4
58e449e092cef646cf8a9dc3e467959c978ddb06ce57a50ed18973cf0cd82b29
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
9109818aa3e59aa5fd052a2e55ec5c824e1af22f07aacee86c9561b2f33f935d
9520018fa5d81f4e4dc9d06afb576f90cbbaba209cfcc6cb60e1464647f7890b
bbcaf72a104039211250b86b7c09d3df175ea10173e70e4740edbc822ae5c89c
c613488d49d9d604961ddea2972072c9aadfee63019fb3054d42e1ea67494a34
c7c98e71bfcd2aa6867179314b7c4f10e39a49c37c1e038fa97528af88000940
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d1854f2659dc32e24936df4a715d520ba3b2d3da5b03a3fe84d5904446bbb20a
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed0e6c2dafc13789782abc2ce063f93fe13d7593579892cc011ce3476b59518c
f70a1c4355672de33b4f6af28f01121e969e9ac38365905c7ba6b4701a054792
f886516f3d41e9e7bd994c7f7a39a89cafae9483f90396cb0ddeafe8d1ea5e72
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

newenrollmentplans.com Open in urlscan Pro 172.67.194.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

32 Requests

94 %HTTPS

36 %IPv6

9 Domains

11 Subdomains

12 IPs

3 Countries

495 kBTransfer

1082 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

newenrollmentplans.com Open in urlscan Pro
172.67.194.109 Public Scan

Screenshot
Live screenshot

Full Image

32
Requests

94 %
HTTPS

36 %
IPv6

9
Domains

11
Subdomains

12
IPs

3
Countries

495 kB
Transfer

1082 kB
Size

5
Cookies

32 HTTP transactions
0 data transactions